Protection of a computer or data network from undesired and unauthorized data disclosure, interception or alteration has been a perennial concern in the field of computer and network security. For example, firewall and anti-spyware software have been developed to address security concerns for computers and networks connected to the Internet and to protect them from possible cyber-attacks such as Trojan horse-type viruses or worms that may trigger undesired and unauthorized data disclosure by these computers and networks. However, for high security computer networks such as those used by government agencies and intelligence community and certain commercial applications, conventional network security devices such as firewalls may not provide sufficiently reliable protection from undesired data disclosure.
Alternative network security methods and devices based on unidirectional data transfer have been devised to address the network security concern. For example, U.S. Pat. No. 5,703,562 to Nilsen (“the '562 Patent”), the contents of which are hereby incorporated by reference in its entirety, provides an alternative way to address the network security concern. The '562 Patent discloses a method of transferring data from an unsecured computer to a secured computer over a one-way optical data link comprising an optical transmitter on the sending side and an optical receiver on the receiving side. By providing such an inherently unidirectional data link to a computer/data network to be protected, one can eliminate any possibility of unintended data leakage out of the computer/data network over the same link.
Any data link that strictly enforces the unidirectionality of data flow is called a one-way link or one-way data link. In other words, it is physically impossible to send information or data of any kind through a one-way data link in the reverse direction. A one-way data link may be hardware-based, software-based, or based on some combination of hardware and software.
One-way data transfer systems based on such one-way data links provide network security to data networks by isolating the networks from potential security breaches (i.e., undesired and unauthorized data flow out of the secure network) while still allowing them to import data from the external source in a controlled fashion. FIG. 1 schematically illustrates an example of one such one-way data transfer system 100. In the one-way data transfer system shown in FIG. 1, two computing platforms 101 and 102 (respectively, “the send platform” and “the receive platform”) are connected to the unsecured external network 104 (“the source network”) and the secure network 105 (“the destination network”), respectively. The send platform 101 is connected to the receive platform 102 by a one-way data link 103, which may be an optical link comprising, for example, a high-bandwidth optical fiber. This one-way optical data link 103 may be configured to operate as a unidirectional data gateway from the source network 104 to the secure destination network 105 by having its ends connected to an optical transmitter on the send platform and to an optical receiver on the receive platform.
A configuration such as the one shown in FIG. 1 physically enforces one-way data transfer at both ends of the optical fiber connecting the send platform 101 to the receive platform 102, thereby creating a truly unidirectional data transfer link between the source network 104 and the destination network 105. One-way data transfer systems based on a one-way data link are designed to transfer data or information in only one direction, making it physically impossible to transfer any kind of data, such as handshaking protocols, error messages, or busy signals, in the reverse direction. Such physically imposed unidirectionality in data flow cannot be hacked by a programmer, as is often done with firewalls, where unidirectional rules are software-protected (e.g., password authentication, etc.). Accordingly, the one-way data transfer system based on a one-way data link ensures that data residing on the isolated destination secure computer or network is maximally protected from any undesired and unauthorized disclosure. Alternatively, the source network is isolated from any malware contained in the destination network.
Software systems and applications, whether for direct use on a computer or embedded in other devices (e.g., firmware), often need to be installed and/or updated before initial use or periodically during the lifetime of such computer or device (i.e., to update to a new version or release). Such updates may add features, fix known problems and/or support the connection to or use of additional hardware and software components and systems. An initial software version or a software update (collectively a “payload” or “install payload”) may be delivered by the software or device manufacturer (or its agent) via recorded physical digital media (e.g., CDs, DVDs, USB drives, hard drives, etc.) or by making it available on an online server for delivery to or retrieval by an end user of the software or device. In some cases, e.g., a surgically-implanted device having internal updatable software/firmware, the payload may only be loaded into the device at a physician's office or other secure healthcare facility via a specialized programming apparatus.
There are cases in which the install payload could be compromised as the result of malicious modifications to code residing either on a physical media or on an online server. In other scenarios, regulatory and/or security requirements may forbid the introduction of physical media into a facility where the systems requiring the install payload is needed, e.g., because of the secure nature of such facility. For these scenarios, connecting to any external network may also be forbidden because of the danger posed by information exfiltration and exposure to malware as discussed above.
As described in U.S. Pat. No. 8,352,450, issued on Jan. 8, 2013, the contents of which are incorporated herein by reference, files based on various conventional transport protocols may be transferred across a one-way data link under suitable arrangements. The following example illustrates transfer of files based on the Transmission Control Protocol (TCP) across a one-way data link. FIG. 2 is a functional block diagram that schematically illustrates implementation of a TCP-based secure file transfer across a single one-way data link in a one-way data transfer system 200.
Construction of the conventional TCP sockets requires bilateral communications since it requires an acknowledgement channel from the receive node to the send node. Accordingly, the conventional TCP/IP protocol cannot be implemented directly in a one-way data transfer system based on a one-way data link, since no bilateral “hand shaking” is allowed over the one-way link due to physical enforcement of unidirectionality of data flow. Instead, the one-way data transfer system 200 illustrated in FIG. 2 uses a TCP simulation application called TCP proxy, which is preferably a TCP/IP socket-based proxy software, but may also be hardware-based or based on a suitable combination of software and hardware, to simulate the TCP/IP protocol across the one-way data link 207.
In FIG. 2, a TCP server proxy 205 fully implements the TCP/IP protocol in its bilateral communications 203 with the upstream TCP file client 202 residing in a source platform 201. The TCP server proxy 205 may reside within the send node 204 as shown in FIG. 2, or alternatively, may be separate from but coupled to the send node 204. After the TCP server proxy 205 receives files from the TCP file client 202, the send node 204 sends the files through its interface 206 to the one-way data link 207. After the receive node 208 receives the files through its interface 209 from the one-way data link 207, the TCP client proxy 210 communicates under the full implementation of the TCP/IP protocol with a TCP file server 213 residing in a destination platform 212 and forwards the received files to the TCP file server 213. The TCP client proxy 210 may reside within the receive node 208 as shown in FIG. 2, or alternatively, may be separate from but coupled to the receive node 208.
In certain situations, it would be advantageous to use a one-way data link with an independent link layer protocol for one-way transfer so that non-routable point to point communications with a true IP protocol break can be enforced. With these properties, data packets or files cannot be accidentally routed in the network and other protocols (such as printer protocols, etc.) will not route across the one-way data link. An exemplary configuration enforcing such non-routable point to point communications with a true IP protocol break can be implemented in the one-way file transfer system 200 of FIG. 2. The TCP-based file transfer system 200 may be configured to prohibit transmission of IP information across the one-way data link 207. When the TCP server proxy 205 receives a file from the TCP file client 202, it removes the IP information normally carried in the file data packet headers under the TCP/IP protocol and replaces it with pre-assigned point-to-point channel numbers, so that no IP information is sent across the one-way data link 207. Instead, predetermined IP routes may be defined at the time of the configuration of the system 200 in the form of channel mapping tables residing in the TCP server proxy 205 associated with the send node 204 and the TCP client proxy 210 associated with the receive node 208. The send node 204 then sends the files with the pre-assigned channel numbers to the receive node 208 through its interface 206 across the one-way data link 207, which are received by the receive node 208 through its interface 209. Upon receipt of the files, the TCP client proxy 210 then maps the channel numbers from the received files to the corresponding predetermined IP address of a destination platform 212, to which the files are forwarded.
For the security of the overall one-way file transfer system 200, the IP address-to-channel number mapping table residing in the send node 204 may be different from the channel number-to-IP addressing mapping table residing in the receive node 208, and furthermore, neither table may be re-constructed on the basis of the other table. Neither table alone reveals the overall IP routing configuration from the source platform 201 to the destination platform 212. In this way, the IP information of the destination platform 212 may remain undisclosed to the sender at the source platform 201 and the security of the overall system 200 can be maintained.
Under the conventional TCP/IP protocol, the acknowledgement mechanism requiring bilateral communications may provide for error detection. However, the one-way data link 207 forecloses such means. Instead, the one-way data transfer system 200 may assure file integrity by applying, for example, a hash algorithm such as MD5 to each file being transferred over the one-way data link 207. The send node 204 calculates an MD5 hash number for the file and sends the resulting hash number along with the file to the receive node 208 over the one-way data link 207. When the receive node 208 receives the file, it may re-calculate a hash number for the received file and compare the result with the hash number calculated by the send node 204. By comparing these results, the receive node 208 may be able to determine as to whether any error has occurred during the file transfer across the one-way data link.
The risk for the compromise of file data integrity increases over time, whether the data is being transmitted over a network or at rest in storage. This is due to data being exposed to network components (when in transit) or available for examination and modification (when stored).
Certain networks are particularly sensitive to importing file data from sources outside of its perimeter, and usually scan the file for malware prior to its intake to protect the network and equipment coupled to the network. A problem arises if the file is being moved in a piece-meal fashion, as opposed to all at once, since portions of malware may look innocent to a scanner when viewed separately, but become harmful when reassembled. This scenario can happen when a file is remotely mounted on a server outside of the perimeter of a network and when parts of the file are transferred by browsing or other access methods. This scenario may occur in particular when using a distributed file system across a network, for example NFS (Network File System).
FIG. 3 shows a typical system 300 for transferring information from a lower security enclave 310 into a higher security enclave 312 (across the security border 311). System 300 includes a scanned data server 301 coupled to a file repository 302 in the first security enclave 310 and a partial data server 321 coupled to a file repository 322 in the second security domain. The scanned data server 301 is coupled to the partial data server 321 via a one-way data link 330. One way data link 330 allows data to flow from the lower security enclave 310 into the higher security enclave 312 and prevents data from flowing in the reverse direction. One or more clients 333 are coupled to the partial data server 321 for accessing data on file repository 322. The data flowing across one-way diode 330 may be pushed by scanned data server 301 or may be requested by a client 333, for example via a separate link 334 which is also protected by a one-way data link 331 in the opposite direction. The two one-way data links 330, 331 operate as described in U.S. Pat. No. 7,992,209 B1 to Menoher et al. (“the '209 Patent”), incorporated by reference in its entirety herein, in maintaining data from each link 330, 331 separate. Data may also be requested by client 333 via an out-of-band medium. Even if the files (e.g., file 303 shown in FIG. 3) on the lower security enclave 310 are scanned prior to their placement into storage and later retrieval by the scanned data server 301, the integrity of such files cannot be guaranteed over time. This is not of great concern when a file is transmitted in its entirety to the higher security enclave 312, since the file may be rescanned as part of the transfer process. However, issues arise when partial file transfers (i.e., when only segments 324 of a complete file 323) are performed because it is not possible to scan these segments 324 alone to ensure they are free from malware. As one of ordinary skill in the art will readily appreciate, a virus or other malware-type infection may occupy only part of a file, but may span an area in the file greater than the file segment. In such situations, scanning of each file segment alone will not identify the virus or other malware.
The present invention provides a method and system which overcomes the problems of the prior art. Other advantages of the present invention will become apparent from the following description.